Deploy Egress Gateway on Kubernetes
Deploy the platform-supplied Egress Gateway to Kubernetes after validating the issued image, configuration, ingress, and operations plan.
- Internal serviceKeep the gateway inside your network
- Central configurationOne route for supported clients
- Managed providersNo separate cluster provider config
For platform teams deploying the platform-supplied Egress Gateway into Kubernetes. Egress Gateway is a shared gateway for AI clients, so a client connecting to an existing gateway does not need a local Defender installation.
AI client -> Egress Gateway -> AI provider
The cluster build exposes a token-authenticated /gateway/... route. The organization-specific endpoint and path convention must be supplied and validated by the platform team. See Connect your AI tools to Egress Gateway for client setup.
Before deploying
Chaos Labs and your platform team supply the deployment package and operating instructions for your organization. Confirm image access, control-plane connectivity, ingress and TLS topology, network boundaries, health checks, rollout, and rollback before deploying.
Obtain the required deployment inputs
Before deploying, obtain all of the following from Chaos Labs and the platform owner:
- A versioned image and any registry pull instructions
- The approved manifest, Helm values, or equivalent deployment configuration
- The exact gateway endpoint and ingress path convention for clients
- The control-plane and ingestion endpoints, network requirements, and TLS policy
- Health, rollout, scaling, upgrade, and rollback instructions
- A test user and the issued credential needed to verify forwarding and capture attribution
Use the image and configuration supplied for your organization. Registry access and network topology depend on your deployment.
Configure the supplied deployment
Use the platform-provided deployment configuration. A nonempty CAPTURE_API_URL enables capture upload, so use the supplied ingestion endpoint exactly as instructed:
CAPTURE_API_URL=https://<ingestion-endpoint-provided-by-chaos-labs>Replace the placeholder with the ingestion endpoint supplied for your deployment. Keep the client ingress, gateway path convention, authentication headers, and TLS termination aligned with the supplied operating instructions.
Deploy and validate
Apply or upgrade the gateway only with the supplied configuration and operating procedure. Then verify all of the following:
- The Deployment and its platform-defined health checks are available.
- The client network can reach the issued gateway endpoint through the supplied ingress path and TLS configuration.
- Network policy, firewall, DNS, and TLS rules allow the required gateway, provider, control-plane, and ingestion connections.
- A test user can configure an AI client with the issued gateway endpoint and credential.
- A test request receives a provider response.
- The matching activity appears under the test user in the relevant user profile in Cortex Atlas.
A provider response verifies forwarding. The matching Cortex activity separately verifies capture attribution and ingestion. Both checks are needed before the deployment is accepted.
Operate the gateway
Use the platform-provided procedures for monitoring, scaling, upgrades, and rollback. Monitor the health signals, restarts, request failures, latency, resource saturation, and outbound connectivity defined for the supplied deployment. If forwarding works but activity is missing, verify the supplied ingestion configuration and that intermediaries preserve the required client authentication headers.